Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Karima Health, a clinic group, finds that a lost unencrypted laptop holds patient records. The board wants to avoid recurrence through an information security policy. Which policy measure best addresses the root cause in a way that is preventive rather than detective?

Mandatory full-disk encryption on portable devices is best, because it is a preventive control that keeps patient data unreadable if a device is lost. Log reviews, insurance and investigations only detect, fund or respond to breaches after they happen rather than preventing exposure.

  1. AMandatory full-disk encryption on all portable devicesCorrect
  2. BMonthly review of the incident log by internal audit
  3. CInsurance cover for data breach fines
  4. DAppointing an external firm to investigate each loss

Explanation

Encryption is a preventive control that makes lost data unreadable, addressing the cause. Log review is detective, insurance transfers financial loss only, and investigation is reactive. The key distractor, log review, would only reveal incidents after they occur.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions